> ## Documentation Index > Fetch the complete documentation index at: https://docs.blujay.io/llms.txt > Use this file to discover all available pages before exploring further. # Upload an attachment > Starts an upload for a file you can reuse in messages. The response gives you an `upload_url` and `upload_headers`. 1. `PUT` the file's raw bytes to `upload_url` with exactly the `upload_headers` returned. Don't use multipart form data. The URL expires after 15 minutes. 2. Send the `attachment_id` in a `media` message part, or call `GET /v1/attachments/{attachment_id}` to check it. There's no separate "complete" call. Blujay checks the bytes the first time you read the attachment or send it, so the size and type must match what you declared. Files can be up to 100 MiB. Attachment endpoints share a limit of 60 requests per minute per API key. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/attachments openapi: 3.1.0 info: title: Blujay API version: 1.0.0 description: >- The Blujay API lets you send and receive iMessage, RCS and SMS messages from your Blujay phone numbers, manage contacts, and receive real-time webhooks. Every response uses the same JSON envelope and carries a `trace_id` you can share with support. Authenticate with your workspace API key. servers: - url: https://api.blujay.io description: Production security: - PublicApiKey: [] tags: - name: Auth description: Check which workspace and credential a request is using. - name: Chats description: >- Direct and group conversations between your Blujay numbers and your contacts. - name: Messages description: Send, read, edit, unsend and retry messages. - name: Phone Numbers description: >- Your Blujay numbers, whether each can send right now, and their live sending limits. - name: Capability description: >- Check whether a phone number can be reached by iMessage, RCS or SMS before you send. - name: Contacts description: Create, find, update, tag, assign and opt out contacts. - name: vCards description: >- Saved contact cards that you can send in a message. Recipients get a native contact card over iMessage, SMS or RCS. - name: Team Members description: People in your workspace you can assign contacts to. - name: Workflows description: Enroll contacts in workflows you start manually. - name: Attachments description: >- Upload files once and reuse them in messages, or download files from messages. - name: Webhooks description: Subscribe to events, inspect delivery attempts and verify signatures. paths: /v1/attachments: post: tags: - Attachments summary: Upload an attachment description: > Starts an upload for a file you can reuse in messages. The response gives you an `upload_url` and `upload_headers`. 1. `PUT` the file's raw bytes to `upload_url` with exactly the `upload_headers` returned. Don't use multipart form data. The URL expires after 15 minutes. 2. Send the `attachment_id` in a `media` message part, or call `GET /v1/attachments/{attachment_id}` to check it. There's no separate "complete" call. Blujay checks the bytes the first time you read the attachment or send it, so the size and type must match what you declared. Files can be up to 100 MiB. Attachment endpoints share a limit of 60 requests per minute per API key. operationId: createPublicAttachment requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateAttachmentRequest' examples: jpegUpload: summary: Declare a JPEG upload value: filename: photo.jpg content_type: image/jpeg size_bytes: 428731 responses: '201': description: The upload URL and headers for the new attachment. headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object required: - data properties: data: $ref: '#/components/schemas/PublicAttachmentUpload' examples: jpegUpload: summary: Upload started for a JPEG value: status: success data: attachment_id: att_abc123 upload_url: >- https://uploads.example.com/att_abc123?signature=8c1f0e2b upload_expires_at: '2026-10-14T17:16:00.000Z' upload_headers: Content-Type: image/jpeg Content-Length: '428731' download_url: /v1/attachments/att_abc123/content trace_id: trc_8f2a1c0e4b7d timestamp: '2026-10-14T17:01:00.000Z' '400': $ref: '#/components/responses/ValidationError' '413': description: The file is larger than 100 MiB (`ATTACHMENT_TOO_LARGE`). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '415': description: >- The filename or content type isn't allowed (`UNSUPPORTED_ATTACHMENT_TYPE`). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '429': description: >- Your workspace has too many uploads waiting for their bytes (`ATTACHMENT_CAPACITY_EXCEEDED`), or you hit the request limit (`RATE_LIMIT_EXCEEDED`). Retry after `Retry-After` seconds. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '503': description: >- Attachments are temporarily unavailable (`ATTACHMENT_STORAGE_UNAVAILABLE`). Retry shortly. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - PublicApiKey: [] components: schemas: CreateAttachmentRequest: type: object additionalProperties: false required: - filename - content_type - size_bytes properties: filename: type: string examples: - receipt.jpg minLength: 1 maxLength: 255 description: The file name, without any folder path. content_type: type: string examples: - image/jpeg maxLength: 255 pattern: ^[a-z0-9][a-z0-9!#$&^_.+-]*/[a-z0-9][a-z0-9!#$&^_.+-]*$ description: Lowercase MIME type without parameters, for example `image/jpeg`. size_bytes: type: integer examples: - 284512 minimum: 1 maximum: 104857600 SuccessEnvelope: type: object description: Wraps every successful response. The result is in `data`. required: - status - trace_id - timestamp properties: status: type: string enum: - success trace_id: $ref: '#/components/schemas/TraceId' timestamp: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time client_request_id: type: string description: >- Your `X-Request-ID` header value, echoed back when you send one. Not included on the send responses (`POST /v1/chats`, `POST /v1/chats/{chat_id}/messages`, `POST /v1/messages/{message_id}/retry`); keep your own mapping from your request ID to the returned message ID there. PublicAttachmentUpload: type: object additionalProperties: false required: - attachment_id - upload_url - upload_expires_at - upload_headers - download_url properties: attachment_id: $ref: '#/components/schemas/AttachmentId' upload_url: type: string examples: - https://uploads.example.com/att_abc123?signature=8c1f0e2b format: uri pattern: ^https:// description: >- URL to `PUT` the file's raw bytes to. It works for this file only and expires after 15 minutes. upload_expires_at: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time upload_headers: type: object additionalProperties: false required: - Content-Type - Content-Length properties: Content-Type: type: string examples: - image/jpeg Content-Length: type: string examples: - '284512' pattern: ^[1-9][0-9]*$ description: >- Send exactly these headers with the `PUT`. Don't use `multipart/form-data`. download_url: type: string examples: - /v1/attachments/att_abc123/content pattern: ^/v1/attachments/att_.+/content$ ErrorEnvelope: type: object description: >- Wraps every error response. Branch on `error.code`, and include `trace_id` when you contact support. required: - status - error - trace_id - timestamp properties: status: const: error error: $ref: '#/components/schemas/PublicError' trace_id: $ref: '#/components/schemas/TraceId' timestamp: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time client_request_id: type: string description: Your `X-Request-ID` header value, echoed back when you send one. TraceId: type: string examples: - trc_8f2a1c0e4b7d pattern: ^trc_[A-Za-z0-9_-]+$ AttachmentId: type: string examples: - att_abc123 pattern: ^att_[A-Za-z0-9_-]+$ PublicError: type: object required: - code - message - type - http_status - retryable - doc_url - details properties: code: type: string description: Stable, machine-readable error code. Branch on this value. examples: - RATE_LIMIT_EXCEEDED - QUEUE_UNAVAILABLE - FEATURE_NOT_ENABLED message: type: string description: Human-readable explanation. It can change, so don't parse it. type: type: string description: Broad error category. examples: - validation - auth - idempotency - rate_limit - queue - feature_gate http_status: type: integer description: The HTTP status code of the response. enum: - 400 - 401 - 403 - 404 - 409 - 413 - 415 - 422 - 429 - 500 - 502 - 503 retryable: type: boolean description: Whether sending the same request again later can succeed. doc_url: type: string format: uri description: Link to documentation for this error code. details: type: array description: >- Extra structured context, such as the fields that failed validation or the limit you hit. items: type: object additionalProperties: true retry_after: type: integer minimum: 1 description: >- Seconds to wait before retrying. Also sent as the `Retry-After` header. reset_at: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time description: When the limit you hit resets. headers: XTraceID: description: >- Unique ID for this request. It matches `trace_id` in the body. Include it when you contact Blujay support. schema: $ref: '#/components/schemas/TraceId' responses: ValidationError: description: The request is invalid. `details` lists the fields that failed. headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' examples: invalidInput: value: status: error error: code: VALIDATION_ERROR message: Request validation failed type: validation http_status: 400 retryable: false doc_url: https://docs.blujay.io/errors/validation-error details: [] trace_id: trc_8f2a1c0e4b7d timestamp: '2026-10-14T00:00:00.000Z' securitySchemes: PublicApiKey: type: http scheme: bearer bearerFormat: blu_... description: > Your workspace API key, sent as `Authorization: Bearer blu_...`. Workspace admins can find it in the Blujay app under **API**. An API key has full access to your workspace and works on every endpoint. There is no test mode: every key sends real messages and changes real data, so keep it secret and use it only from your server. Each API key can make 600 read requests and 120 write requests per minute, plus 60 attachment requests per minute. Over a limit you get `429 RATE_LIMIT_EXCEEDED` with `Retry-After`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.